Edit tour

Windows Analysis Report
setup.exe

Overview

General Information

Sample Name:	setup.exe
Analysis ID:	1343592
MD5:	9dcbe10dc787bde1e69fca29878e6083
SHA1:	6693bc9d31cd96c37bc81c9d49fec7f0948a56fe
SHA256:	928dba830954eca52d25b94bc36c2e5d24b332a2cbfa8cd38802258caaa9d2c4
Infos:

Detection

Score:	63
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Compliance

Score:	3
Range:	0 - 100

Signatures

Multi AV Scanner detection for submitted file

Sigma detected: Dot net compiler compiles file from suspicious location

Multi AV Scanner detection for dropped file

Snort IDS alert for network traffic

Uses netsh to modify the Windows network and firewall settings

Yara detected Generic Downloader

Tries to harvest and steal browser information (history, passwords, etc)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Creates files inside the system directory

PE file contains sections with non-standard names

Stores large binary data to the registry

Stores files to the Windows start menu directory

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

Uses insecure TLS / SSL version for HTTPS connection

Contains long sleeps (>= 3 min)

Enables debug privileges

EXE planting / hijacking vulnerabilities found

Is looking for software installed on the system

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

DLL planting / hijacking vulnerabilities found

PE file contains an invalid checksum

Adds / modifies Windows certificates

Drops PE files

Tries to load missing DLLs

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Compiles C# or VB.Net code

Creates a process in suspended mode (likely to inject code)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Classification

Process Tree

System is w10x64_ra

setup.exe (PID: 1368 cmdline: C:\Users\user\Desktop\setup.exe MD5: 9DCBE10DC787BDE1E69FCA29878E6083)

WebCompanionInstaller.exe (PID: 5484 cmdline: .\WebCompanionInstaller.exe --savename=Setup.exe --partner=IN220101 --nonadmin --direct --tych --campaign=18282981021 --version=10.901.2.519 MD5: 4A5B051EDBC60C58D0FA08810AB2FA0A)

cmd.exe (PID: 5872 cmdline: "C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=http://+:9007/ user=Everyone MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3024 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 5868 cmdline: netsh http add urlacl url=http://+:9007/ user=Everyone MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

WebCompanion.exe (PID: 7116 cmdline: "C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe" --install --geo= MD5: 7BB65BB24E9A4A04E8D3423D12CF4665)

csc.exe (PID: 2808 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bwneskvk.cmdline MD5: 2B9482EB5D3AF71029277E18F6C656C0)

conhost.exe (PID: 6484 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cvtres.exe (PID: 1056 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESA00A.tmp" "c:\Users\user\AppData\Local\Temp\CSC9FF9.tmp" MD5: E118330B4629B12368D91B9DF6488BE0)

csc.exe (PID: 6068 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\gu1rlzui.cmdline MD5: 2B9482EB5D3AF71029277E18F6C656C0)

conhost.exe (PID: 6100 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cvtres.exe (PID: 6348 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESA903.tmp" "c:\Users\user\AppData\Local\Temp\CSCA8F2.tmp" MD5: E118330B4629B12368D91B9DF6488BE0)

csc.exe (PID: 880 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\uld_vmts.cmdline MD5: 2B9482EB5D3AF71029277E18F6C656C0)

conhost.exe (PID: 2348 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cvtres.exe (PID: 5036 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESB3F0.tmp" "c:\Users\user\AppData\Local\Temp\CSCB3DF.tmp" MD5: E118330B4629B12368D91B9DF6488BE0)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanionInstaller.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Search.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanionInstaller.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Search.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanionInstaller.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Search.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanionInstaller.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Search.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanionInstaller.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Search.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
Click to see the 21 entries

Sigma Signatures

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bwneskvk.cmdline, CommandLine: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bwneskvk.cmdline, CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe" --install --geo= , ParentImage: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe, ParentProcessId: 7116, ParentProcessName: WebCompanion.exe, ProcessCommandLine: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bwneskvk.cmdline, ProcessId: 2808, ProcessName: csc.exe

Snort Signatures

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52497564432849740 11/16/23-14:21:53.220878
SID:	2849740
Source Port:	49756
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52498374432849740 11/16/23-14:22:58.363979
SID:	2849740
Source Port:	49837
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52498604432849740 11/16/23-14:23:01.817543
SID:	2849740
Source Port:	49860
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52498184432849740 11/16/23-14:22:55.315927
SID:	2849740
Source Port:	49818
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52499374432849740 11/16/23-14:23:14.094484
SID:	2849740
Source Port:	49937
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52499564432849740 11/16/23-14:23:23.548121
SID:	2849740
Source Port:	49956
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52498944432849740 11/16/23-14:23:06.133993
SID:	2849740
Source Port:	49894
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52498674432849740 11/16/23-14:23:02.589272
SID:	2849740
Source Port:	49867
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52499754432849740 11/16/23-14:23:26.482208
SID:	2849740
Source Port:	49975
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52497304432849740 11/16/23-14:21:48.202535
SID:	2849740
Source Port:	49730
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52497294432849740 11/16/23-14:21:48.164707
SID:	2849740
Source Port:	49729
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52498004432849740 11/16/23-14:22:51.082711
SID:	2849740
Source Port:	49800
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52497984432849740 11/16/23-14:22:51.007985
SID:	2849740
Source Port:	49798
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52498834432849740 11/16/23-14:23:04.821504
SID:	2849740
Source Port:	49883
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52498154432849740 11/16/23-14:22:54.740443
SID:	2849740
Source Port:	49815
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52499074432849740 11/16/23-14:23:08.438996
SID:	2849740
Source Port:	49907
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52497454432849740 11/16/23-14:21:50.946312
SID:	2849740
Source Port:	49745
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52499534432849740 11/16/23-14:23:23.201366
SID:	2849740
Source Port:	49953
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52498454432849740 11/16/23-14:23:00.067333
SID:	2849740
Source Port:	49845
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52497614432849740 11/16/23-14:21:54.380445
SID:	2849740
Source Port:	49761
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52497744432849740 11/16/23-14:21:56.930831
SID:	2849740
Source Port:	49774
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52498554432849740 11/16/23-14:23:01.134765
SID:	2849740
Source Port:	49855
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52497554432849740 11/16/23-14:21:53.196157
SID:	2849740
Source Port:	49755
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52498174432849740 11/16/23-14:22:55.177089
SID:	2849740
Source Port:	49817
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52497684432849740 11/16/23-14:21:55.800698
SID:	2849740
Source Port:	49768
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52498684432849740 11/16/23-14:23:02.593620
SID:	2849740
Source Port:	49868
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52497364432849740 11/16/23-14:21:48.963647
SID:	2849740
Source Port:	49736
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52497494432849740 11/16/23-14:21:52.073139
SID:	2849740
Source Port:	49749
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52497844432849740 11/16/23-14:21:59.354468
SID:	2849740
Source Port:	49784
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52498464432849740 11/16/23-14:23:00.118740
SID:	2849740
Source Port:	49846
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52498014432849740 11/16/23-14:22:51.949030
SID:	2849740
Source Port:	49801
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52497784432849740 11/16/23-14:21:57.936682
SID:	2849740
Source Port:	49778
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52498084432849740 11/16/23-14:22:53.627463
SID:	2849740
Source Port:	49808
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52497274432849740 11/16/23-14:21:46.523132
SID:	2849740
Source Port:	49727
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52498334432849740 11/16/23-14:22:57.695107
SID:	2849740
Source Port:	49833
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52497884432849740 11/16/23-14:22:00.715926
SID:	2849740
Source Port:	49788
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52498244432849740 11/16/23-14:22:56.311267
SID:	2849740
Source Port:	49824
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52499244432849740 11/16/23-14:23:11.585526
SID:	2849740
Source Port:	49924
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52499734432849740 11/16/23-14:23:26.371514
SID:	2849740
Source Port:	49973
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52498814432849740 11/16/23-14:23:04.157579
SID:	2849740
Source Port:	49881
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52497774432849740 11/16/23-14:21:57.842152
SID:	2849740
Source Port:	49777
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52499164432849740 11/16/23-14:23:10.459701
SID:	2849740
Source Port:	49916
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52499434432849740 11/16/23-14:23:14.583964
SID:	2849740
Source Port:	49943
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52498354432849740 11/16/23-14:22:58.177087
SID:	2849740
Source Port:	49835
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52497964432849740 11/16/23-14:22:50.572419
SID:	2849740
Source Port:	49796
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52497694432849740 11/16/23-14:21:55.800651
SID:	2849740
Source Port:	49769
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52498164432849740 11/16/23-14:22:54.742574
SID:	2849740
Source Port:	49816
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52498884432849740 11/16/23-14:23:05.617099
SID:	2849740
Source Port:	49888
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52498284432849740 11/16/23-14:22:56.824402
SID:	2849740
Source Port:	49828
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52499134432849740 11/16/23-14:23:10.110529
SID:	2849740
Source Port:	49913
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52498584432849740 11/16/23-14:23:01.672719
SID:	2849740
Source Port:	49858
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52499054432849740 11/16/23-14:23:07.883360
SID:	2849740
Source Port:	49905
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52497804432849740 11/16/23-14:21:58.551674
SID:	2849740
Source Port:	49780
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52498574432849740 11/16/23-14:23:01.338987
SID:	2849740
Source Port:	49857
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52497634432849740 11/16/23-14:21:54.790525
SID:	2849740
Source Port:	49763
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52497824432849740 11/16/23-14:21:58.623848
SID:	2849740
Source Port:	49782
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52497444432849740 11/16/23-14:21:50.649711
SID:	2849740
Source Port:	49744
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52498764432849740 11/16/23-14:23:03.664568
SID:	2849740
Source Port:	49876
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52499284432849740 11/16/23-14:23:12.157500
SID:	2849740
Source Port:	49928
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52499634432849740 11/16/23-14:23:24.716822
SID:	2849740
Source Port:	49963
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52497484432849740 11/16/23-14:21:52.065730
SID:	2849740
Source Port:	49748
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52497864432849740 11/16/23-14:22:00.334826
SID:	2849740
Source Port:	49786
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52499254432849740 11/16/23-14:23:11.585685
SID:	2849740
Source Port:	49925
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52498254432849740 11/16/23-14:22:56.690231
SID:	2849740
Source Port:	49825
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52499064432849740 11/16/23-14:23:08.121055
SID:	2849740
Source Port:	49906
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52497604432849740 11/16/23-14:21:54.380499
SID:	2849740
Source Port:	49760
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52497734432849740 11/16/23-14:21:56.930125
SID:	2849740
Source Port:	49773
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI - Source IP: 192.168.2.16 - Destination IP: 104.17.9.52

Timestamp:	192.168.2.16104.17.9.52498064432849740 11/16/23-14:22:52.873939
SID:	2849740
Source Port:	49806
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

• AV Detection
• Privilege Escalation
• Compliance
• Spreading
• Networking
• System Summary
• Data Obfuscation
• Persistence and Installation Behavior
• Boot Survival
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Anti Debugging
• HIPS / PFW / Operating System Protection Evasion
• Language, Device and Operating System Detection
• Lowering of HIPS / PFW / Operating System Security Settings
• Stealing of Sensitive Information

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: setup.exe	ReversingLabs: Detection: 23%
Source: setup.exe	Virustotal: Detection: 34%			Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe

Virustotal: Detection: 35%

Perma Link

Privilege Escalation

EXE planting / hijacking vulnerabilities found

Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	EXE: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	EXE: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	EXE: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanionInstaller.exe
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	EXE: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\7za.exe
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	EXE: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Search.exe

DLL planting / hijacking vulnerabilities found

Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WpfAnimatedGif.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	DLL: LINKINFO.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	DLL: USP10.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\System.Data.SQLite.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\de-DE\WebCompanion.resources.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	DLL: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\pt-BR\WebCompanionInstaller.resources.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Interop.IWshRuntimeLibrary.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\es-ES\WebCompanion.resources.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ja-JP\WebCompanion.resources.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\NCalc.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ucrtbased.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	DLL: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Settings.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\fr-CA\WebCompanion.resources.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Interop.WUApiLib.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.SqlLite.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\BCUEngineS.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\BCUSDK.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ja-JP\WebCompanionInstaller.resources.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\vcruntime140d.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ru-RU\WebCompanion.resources.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\log4net.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\es-ES\WebCompanionInstaller.resources.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.CSharp.Utilities.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\zh-CHS\WebCompanionInstaller.resources.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\fr-CA\WebCompanionInstaller.resources.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	DLL: security.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\acs17.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	DLL: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Microsoft.mshtml.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Compression.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.Service.Logger.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	DLL: winnlsres.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	DLL: rasapi32.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	DLL: CRYPTBASE.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	DLL: rtutils.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\it-IT\WebCompanionInstaller.resources.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\liblz4.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	DLL: RichEd20.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	DLL: Wldp.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\tr-TR\WebCompanionInstaller.resources.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Extension.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Ionic.Zip.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\de-DE\WebCompanionInstaller.resources.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	DLL: SSPICLI.DLL
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	DLL: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Events.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	DLL: srvcli.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	DLL: ntshrui.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WcfService.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	DLL: cscapi.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\en-US\WebCompanion.resources.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Interop.LavasoftTcpServiceLib.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\pt-BR\WebCompanion.resources.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\x64\SQLite.Interop.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	DLL: rasman.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	DLL: IPHLPAPI.DLL
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\zh-Hans\WebCompanion.resources.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Interop.Shell32.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\it-IT\WebCompanion.resources.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	DLL: httpapi.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ru-RU\WebCompanionInstaller.resources.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\en-US\WebCompanionInstaller.resources.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\x86\SQLite.Interop.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Interop.SHDocVw.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\MozCompressor.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Repositories.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\tr-TR\WebCompanion.resources.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\DotNetZip.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\LZ4.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	DLL: SECUR32.DLL
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Esent.Interop.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	DLL: msls31.dll

Compliance

Uses 32bit PE files

Source: setup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49726 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49727 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49736 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49739 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49740 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49742 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49743 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49744 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49745 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49747 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49746 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49749 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49748 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49750 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49753 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49752 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49755 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49756 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49757 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49761 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49763 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49766 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49765 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49768 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49769 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49771 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49773 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49774 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49775 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49777 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49778 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49780 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49782 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49784 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49785 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49788 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49789 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49790 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49794 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49796 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49797 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49798 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49799 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49800 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49801 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49803 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49805 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49804 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49806 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49807 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49808 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49809 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49811 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49812 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49813 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49815 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49816 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49818 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49817 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49819 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49821 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49822 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49823 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49824 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49826 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49828 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49825 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49827 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49829 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49831 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49832 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49833 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49835 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49837 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49836 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49839 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49838 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49840 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49841 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49842 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49843 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49845 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49847 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49846 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49848 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49849 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49853 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49850 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49854 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49851 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49852 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49855 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49856 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49857 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49860 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49858 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49859 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49861 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49864 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49862 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49863 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49865 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49867 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49868 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49869 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49870 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49871 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49872 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49875 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49873 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49874 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49877 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49876 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49878 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49880 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49881 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49882 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49883 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49886 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49885 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49888 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49891 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49887 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49889 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49893 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49894 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49895 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49896 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49897 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49898 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49899 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49901 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49902 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49903 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49904 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49905 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49906 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49907 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49908 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49909 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49910 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49911 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49913 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49916 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49917 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49918 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49922 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49919 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49920 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49921 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49925 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49924 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49927 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49928 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49930 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49931 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49932 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49933 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49935 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49937 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49938 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49939 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49940 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49942 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49941 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49943 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49944 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49945 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49953 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49952 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49954 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49955 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49956 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49961 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49959 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49964 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49962 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49963 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49965 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49973 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49975 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49978 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49977 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49983 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49982 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49985 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49984 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49990 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49992 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49991 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49993 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49998 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49999 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:50000 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:50003 version: TLS 1.0

EXE planting / hijacking vulnerabilities found

Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	EXE: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	EXE: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	EXE: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanionInstaller.exe
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	EXE: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\7za.exe
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	EXE: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Search.exe

DLL planting / hijacking vulnerabilities found

Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WpfAnimatedGif.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	DLL: LINKINFO.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	DLL: USP10.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\System.Data.SQLite.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\de-DE\WebCompanion.resources.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	DLL: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\pt-BR\WebCompanionInstaller.resources.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Interop.IWshRuntimeLibrary.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\es-ES\WebCompanion.resources.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ja-JP\WebCompanion.resources.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\NCalc.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ucrtbased.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	DLL: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Settings.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\fr-CA\WebCompanion.resources.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Interop.WUApiLib.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.SqlLite.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\BCUEngineS.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\BCUSDK.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ja-JP\WebCompanionInstaller.resources.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\vcruntime140d.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ru-RU\WebCompanion.resources.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\log4net.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\es-ES\WebCompanionInstaller.resources.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.CSharp.Utilities.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\zh-CHS\WebCompanionInstaller.resources.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\fr-CA\WebCompanionInstaller.resources.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	DLL: security.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\acs17.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	DLL: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Microsoft.mshtml.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Compression.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.Service.Logger.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	DLL: winnlsres.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	DLL: rasapi32.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	DLL: CRYPTBASE.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	DLL: rtutils.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\it-IT\WebCompanionInstaller.resources.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\liblz4.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	DLL: RichEd20.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	DLL: Wldp.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\tr-TR\WebCompanionInstaller.resources.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Extension.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Ionic.Zip.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\de-DE\WebCompanionInstaller.resources.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	DLL: SSPICLI.DLL
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	DLL: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Events.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	DLL: srvcli.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	DLL: ntshrui.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WcfService.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	DLL: cscapi.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\en-US\WebCompanion.resources.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Interop.LavasoftTcpServiceLib.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\pt-BR\WebCompanion.resources.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\x64\SQLite.Interop.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	DLL: rasman.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	DLL: IPHLPAPI.DLL
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\zh-Hans\WebCompanion.resources.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Interop.Shell32.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\it-IT\WebCompanion.resources.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	DLL: httpapi.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ru-RU\WebCompanionInstaller.resources.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\en-US\WebCompanionInstaller.resources.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\x86\SQLite.Interop.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Interop.SHDocVw.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\MozCompressor.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Repositories.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\tr-TR\WebCompanion.resources.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\DotNetZip.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\LZ4.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	DLL: SECUR32.DLL
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	DLL: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Esent.Interop.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	DLL: msls31.dll

Creates a software uninstall entry

Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{cfc97297-c877-42df-8ab4-b183ed1b315e}

Uses new MSVCR Dlls

Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Creates install or setup log file

Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Local\Temp\WcInstaller.log
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\install.txt

PE / OLE file has a valid certificate

Source: setup.exe

Static PE information: certificate valid

Spreading

Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File opened: C:\Users\user\AppData\Roaming\Lavasoft\
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File opened: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File opened: C:\Users\user\AppData\
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File opened: C:\Users\user\AppData\Roaming\
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File opened: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File opened: C:\Users\user\

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49727 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49730 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49729 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49736 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49744 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49745 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49749 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49748 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49755 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49756 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49760 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49761 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49763 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49768 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49769 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49773 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49774 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49777 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49778 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49780 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49782 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49784 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49786 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49788 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49796 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49798 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49800 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49801 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49806 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49808 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49815 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49816 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49817 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49818 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49824 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49825 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49828 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49833 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49835 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49837 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49845 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49846 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49855 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49857 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49858 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49860 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49868 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49867 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49876 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49881 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49883 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49888 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49894 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49906 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49905 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49907 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49913 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49916 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49925 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49924 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49928 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49937 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49943 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49953 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49956 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49963 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49973 -> 104.17.9.52:443
Source: Traffic	Snort IDS: 2849740 ETPRO MALWARE Suspicious Domain (flow .lavasoft .com) in TLS SNI 192.168.2.16:49975 -> 104.17.9.52:443

Yara detected Generic Downloader

Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanionInstaller.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Search.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanionInstaller.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Search.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanionInstaller.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Search.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanionInstaller.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Search.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanionInstaller.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Search.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe, type: DROPPED

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 586Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 425Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 435Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 413Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 405Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 407Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 422Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 438Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /10.1.2.519/WebCompanion-10.1.2.519-prod.zip HTTP/1.1Host: wcdownloadercdn.lavasoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 467Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 438Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 432Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 430Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 429Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 442Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 436Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 406Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 430Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 431Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 414Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 425Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 424Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 424Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 240Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Partner.svc/GetPartnerInfo?partner=IN220101_wb HTTP/1.1Host: wc-partners.lavasoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 240Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /Partner.svc/GetPartnerInfo?partner=IN220101_ab HTTP/1.1Host: wc-partners.lavasoft.com
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 240Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /Partner.svc/GetPartnerInfo?partner=IN220101_ac HTTP/1.1Host: wc-partners.lavasoft.com
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 240Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 240Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 240Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 240Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 240Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 240Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 240Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 240Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 240Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=FirstRun&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 266Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 240Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 240Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /IPService.asmx HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://upclick.com/GetCountryISO2"Host: wsgeoip.lulusoft.comContent-Length: 238Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 240Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 240Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 240Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 240Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 240Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 240Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 240Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 240Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 240Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 240Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 240Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 240Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 240Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 240Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 240Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 240Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 240Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 240Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 240Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 240Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 240Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 240Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 240Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 240Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 240Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 240Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 240Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 240Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 240Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 240Expect: 100-continue

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49726 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49727 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49736 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49739 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49740 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49742 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49743 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49744 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49745 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49747 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49746 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49749 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49748 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49750 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49753 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49752 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49755 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49756 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49757 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49761 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49763 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49766 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49765 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49768 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49769 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49771 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49773 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49774 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49775 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49777 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49778 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49780 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49782 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49784 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49785 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49788 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49789 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49790 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49794 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49796 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49797 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49798 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49799 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49800 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49801 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49803 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49805 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49804 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49806 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49807 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49808 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49809 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49811 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49812 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49813 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49815 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49816 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49818 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49817 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49819 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49821 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49822 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49823 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49824 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49826 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49828 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49825 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49827 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49829 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49831 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49832 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49833 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49835 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49837 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49836 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49839 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49838 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49840 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49841 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49842 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49843 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49845 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49847 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49846 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49848 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49849 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49853 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49850 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49854 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49851 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49852 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49855 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49856 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49857 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49860 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49858 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49859 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49861 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49864 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49862 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49863 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49865 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49867 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49868 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49869 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49870 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49871 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49872 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49875 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49873 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49874 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49877 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49876 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49878 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49880 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49881 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49882 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49883 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49886 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49885 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49888 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49891 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49887 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49889 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49893 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49894 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49895 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49896 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49897 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49898 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49899 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49901 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49902 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49903 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49904 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49905 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49906 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49907 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49908 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49909 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49910 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49911 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49913 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49916 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49917 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49918 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49922 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49919 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49920 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49921 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49925 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49924 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49927 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49928 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49930 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49931 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49932 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49933 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49935 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49937 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49938 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49939 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49940 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49942 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49941 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49943 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49944 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49945 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49953 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49952 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49954 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49955 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49956 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49961 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49959 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49964 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49962 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49963 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49965 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49973 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49975 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49978 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49977 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49983 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49982 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49985 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49984 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49990 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49992 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49991 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49993 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49998 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:49999 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:50000 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.17.9.52:443 -> 192.168.2.16:50003 version: TLS 1.0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49959 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 16 Nov 2023 13:21:33 GMTContent-Type: application/zipContent-Length: 11204891Connection: keep-aliveETag: "4102920859"Last-Modified: Mon, 06 Jun 2022 14:40:21 GMTCF-Cache-Status: HITAge: 2348Expires: Thu, 16 Nov 2023 17:21:33 GMTCache-Control: public, max-age=14400Accept-Ranges: bytesServer: cloudflareCF-RAY: 827009a6efaa275a-SEAData Raw: 50 4b 03 04 14 00 00 00 08 00 c1 53 c6 54 c5 0c b4 f8 a3 42 03 00 48 1f 07 00 13 00 00 00 41 70 70 6c 69 63 61 74 69 6f 6e 2f 37 7a 61 2e 65 78 65 ec bd 79 78 54 45 d6 38 7c 7b 49 d2 59 48 27 40 43 58 c4 56 5b 8d 84 25 63 40 93 34 68 5f d2 4d 6e 43 47 40 44 51 a3 a0 68 0b ae 18 fa b2 c8 22 d8 89 6f 3a d7 56 47 71 46 1d c7 71 de 19 e7 73 c6 65 d4 51 16 d7 ee 04 b2 b0 2f 2e 2c a3 e2 5e a1 05 59 24 24 2c b9 df 39 a7 6e 6f 49 88 3e df f3 fb fd f7 e5 79 d2 77 ab 3a 75 ea d4 a9 53 a7 4e 9d 3a 55 71 d3 93 82 41 10 04 23 fc ab aa 20 ac 13 f8 9f 43 f8 f5 3f 06 ff d9 e7 bf 97 2d bc 93 be f5 82 75 3a cf d6 0b ae 9b 3b 6f 81 75 7e d5 03 77 55 dd 76 9f 75 ce 6d f7 df ff 80 cf 7a fb 9d d6 2a f9 7e eb bc fb ad ce 29 d3 ad f7 3d 70 c7 9d a3 fa f4 c9 b0 69 30 ce 1f 76 77 e7 cd 0f 1b 5f 8f fe 8f fc 66 c9 eb 37 d1 f5 e1 d7 a7 d2 bb 94 d7 5b e8 f9 ee d7 73 e8 3a ef f5 eb e0 ea f8 e6 79 2d dd 62 ed ba 8c ae d7 ce 9b 33 17 e1 74 c5 75 aa 4b 10 ee 78 34 45 98 ff fd 7d 37 45 df 1d 11 2e 12 32 f5 26 41 68 84 da 5f a3 a7 77 39 2d 70 9f 93 40 01 bc d7 73 fa e0 5f 8a a0 d7 08 94 46 2f 3f fc 2e 0d e9 b7 4a cb 14 bb 74 7f 4e ba 15 9c 8f a7 0a 8b f1 a6 30 4d c8 c1 06 d8 91 2a cc 9c 05 d7 63 a9 82 34 52 f8 ff fe 77 c0 28 e4 18 cf fd 79 94 ef ce c5 3e b8 66 6c d0 ea 89 75 ef 92 de 2a 08 b3 47 55 dd 71 9b ef 36 41 68 7b 4f 47 30 85 0f e0 ba 29 39 21 50 c8 31 8a 27 13 f6 8c 80 9f 97 52 05 01 c8 29 3c 9a da 35 5d 68 d4 7c 9e 90 ea 08 75 15 66 c3 f5 f1 d4 ee f0 aa 16 54 cd 41 5a 19 38 6d 08 b7 c3 dd d3 09 ff ff df ff 91 3f 69 fa 8c eb 6f 10 af 13 67 88 d7 8b 37 48 fe 9f f2 25 45 5f b4 bf 42 69 0f dc 64 f2 06 f2 dc 8a 20 06 66 e2 5d c9 8d 26 49 39 e8 51 5a 9d 75 c7 95 d3 0b 1f f0 28 df ba 15 97 20 9a d7 8e 31 7a fd 9d 56 5f 2a fc a6 cb 29 ce d2 e3 be 32 b8 bd 50 4e 87 5b d1 bc ba 31 72 89 e2 32 95 b8 b2 64 00 b0 95 dd 33 4c 10 94 19 70 5b 21 78 03 63 a6 a9 f5 de c0 d0 69 81 19 26 a5 5e 6d 72 fb 37 e8 45 fb 72 53 d5 cb 11 73 70 8a 4e 0a f6 97 dc ca 76 c6 2e 10 04 fb 69 f3 33 21 c9 bf 21 5f 9c 25 de 2a de 22 56 ce ba f5 96 9b 1b b6 6c 21 fc 09 ef 39 88 60 47 cd 7e 49 39 ee 1b 21 85 7f 30 48 4a 9a e4 3f 6c f2 37 a8 92 32 22 55 aa 39 e4 cb c5 52 59 0b b0 3d 62 12 86 6b cd 7e 79 8f a4 98 11 30 02 6c 7d 1d de 6d 29 0a d5 ea a4 80 68 0a 88 39 01 b1 bf a4 84 b1 9c 80 c7 66 9a 0e 05 15 4a 4d 4e 9b b5 53 55 01 ea de a2 90 14 48 48 da 24 e6 a9 f8 c1 1f b6 b2 59 83 04 e1 49 29 38 b9 90 3d 73 3e de 29 0d 50 48 21 a2 4c 7f d2 0c 80 65 05 8a 02 4a 0e c8 60 62 97 53 ce 0d d6 5b 1a 7a fa 6e 65 ef ed 32 08 fc 7b 62 9d 73 62 75 1e c9 eb 5c 6e ea b1 d2 9f 98 79 a5 b7 98 a9 d2 9f 4b ca 14 53 ac d6 6b e1 e5 96 38 2d e7

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flow.lavasoft.comContent-Length: 586Expect: 100-continueConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: flow.lavasoft.com

Source: global traffic	HTTP traffic detected: GET /10.1.2.519/WebCompanion-10.1.2.519-prod.zip HTTP/1.1Host: wcdownloadercdn.lavasoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Partner.svc/GetPartnerInfo?partner=IN220101_wb HTTP/1.1Host: wc-partners.lavasoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Partner.svc/GetPartnerInfo?partner=IN220101_ab HTTP/1.1Host: wc-partners.lavasoft.com
Source: global traffic	HTTP traffic detected: GET /Partner.svc/GetPartnerInfo?partner=IN220101_ac HTTP/1.1Host: wc-partners.lavasoft.com

System Summary

Uses 32bit PE files

Source: setup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Creates files inside the system directory

Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe

File created: C:\Windows\assembly\Desktop.ini

Tries to load missing DLLs

Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe

Section loaded: security.dll

Source: setup.exe	ReversingLabs: Detection: 23%
Source: setup.exe	Virustotal: Detection: 34%

Source: C:\Users\user\Desktop\setup.exe

File read: C:\Users\user\Desktop\setup.exe

Source: setup.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\setup.exe C:\Users\user\Desktop\setup.exe
Source: C:\Users\user\Desktop\setup.exe	Process created: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe .\WebCompanionInstaller.exe --savename=Setup.exe --partner=IN220101 --nonadmin --direct --tych --campaign=18282981021 --version=10.901.2.519
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=http://+:9007/ user=Everyone
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh http add urlacl url=http://+:9007/ user=Everyone
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe "C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe" --install --geo=
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh http add urlacl url=http://+:9007/ user=Everyone
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bwneskvk.cmdline
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESA00A.tmp" "c:\Users\user\AppData\Local\Temp\CSC9FF9.tmp"
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\gu1rlzui.cmdline
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESA903.tmp" "c:\Users\user\AppData\Local\Temp\CSCA8F2.tmp"
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\uld_vmts.cmdline
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESB3F0.tmp" "c:\Users\user\AppData\Local\Temp\CSCB3DF.tmp"
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bwneskvk.cmdline
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\gu1rlzui.cmdline
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\uld_vmts.cmdline
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESA00A.tmp" "c:\Users\user\AppData\Local\Temp\CSC9FF9.tmp"
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESA903.tmp" "c:\Users\user\AppData\Local\Temp\CSCA8F2.tmp"
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESB3F0.tmp" "c:\Users\user\AppData\Local\Temp\CSCB3DF.tmp"
Source: C:\Users\user\Desktop\setup.exe	Process created: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe .\WebCompanionInstaller.exe --savename=Setup.exe --partner=IN220101 --nonadmin --direct --tych --campaign=18282981021 --version=10.901.2.519
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe "C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe" --install --geo=

Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}\InProcServer32

Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe

File created: C:\Users\user\AppData\Roaming\Lavasoft

Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe

File created: C:\Users\user\AppData\Local\Temp\WcInstaller.log

Source: classification engine

Classification label: mal63.troj.spyw.expl.evad.winEXE@24/167@9/22

Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\fd340967acfc2948620252bd3a6aabb7\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\fd340967acfc2948620252bd3a6aabb7\mscorlib.ni.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\faf93f57aa8c4c5dddd9cd0de441d5a1\mscorlib.ni.dll
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe	Section loaded: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe	Section loaded: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe	Section loaded: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6100:120:WilError_03
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2348:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6484:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3024:120:WilError_03
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\servicemodelservice 3.0.0.0

Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe

File written: C:\Windows\assembly\Desktop.ini

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses Microsoft Silverlight

Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Creates a software uninstall entry

Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{cfc97297-c877-42df-8ab4-b183ed1b315e}

Uses new MSVCR Dlls

Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

PE / OLE file has a valid certificate

Source: setup.exe

Static PE information: certificate valid

Data Obfuscation

PE file contains sections with non-standard names

Source: setup.exe

Static PE information: section name: .sxdata

PE file contains an invalid checksum

Source: setup.exe

Static PE information: real checksum: 0x8e265 should be: 0x8f257

Compiles C# or VB.Net code

Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bwneskvk.cmdline
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\gu1rlzui.cmdline
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\uld_vmts.cmdline
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bwneskvk.cmdline
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\gu1rlzui.cmdline
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\uld_vmts.cmdline

Persistence and Installation Behavior

Drops PE files

Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WpfAnimatedGif.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\System.Data.SQLite.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\de-DE\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\pt-BR\WebCompanionInstaller.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Interop.IWshRuntimeLibrary.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\es-ES\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ja-JP\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\NCalc.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ucrtbased.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Settings.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\fr-CA\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Interop.WUApiLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.SqlLite.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanionInstaller.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\BCUEngineS.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\BCUSDK.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ja-JP\WebCompanionInstaller.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Search.exe	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\de-DE\WebCompanionInstaller.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\ICSharpCode.SharpZipLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\vcruntime140d.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ru-RU\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\log4net.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\es-ES\WebCompanionInstaller.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\zh-CHS\WebCompanionInstaller.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.CSharp.Utilities.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\fr-CA\WebCompanionInstaller.resources.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe	File created: C:\Users\user\AppData\Local\Temp\bwneskvk.dll	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\en-US\WebCompanionInstaller.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\acs17.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Microsoft.mshtml.dll	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\ru-RU\WebCompanionInstaller.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Compression.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.Service.Logger.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\it-IT\WebCompanionInstaller.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\liblz4.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\tr-TR\WebCompanionInstaller.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Extension.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Ionic.Zip.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\de-DE\WebCompanionInstaller.resources.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe	File created: C:\Users\user\AppData\Local\Temp\uld_vmts.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Events.dll	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\pt-BR\WebCompanionInstaller.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WcfService.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\en-US\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Interop.LavasoftTcpServiceLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\pt-BR\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\fr-CA\WebCompanionInstaller.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\x64\SQLite.Interop.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\7za.exe	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\ja-JP\WebCompanionInstaller.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\it-IT\WebCompanionInstaller.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\zh-Hans\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Interop.Shell32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\tr-TR\WebCompanionInstaller.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\it-IT\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ru-RU\WebCompanionInstaller.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\en-US\WebCompanionInstaller.resources.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe	File created: C:\Users\user\AppData\Local\Temp\gu1rlzui.dll	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\x86\SQLite.Interop.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Interop.SHDocVw.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\MozCompressor.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Repositories.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\tr-TR\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\es-ES\WebCompanionInstaller.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\DotNetZip.dll	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\zh-CHS\WebCompanionInstaller.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\LZ4.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Esent.Interop.dll	Jump to dropped file

Creates install or setup log file

Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Local\Temp\WcInstaller.log
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\install.txt

Boot Survival

Stores files to the Windows start menu directory

Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lavasoft
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lavasoft\WebCompanion
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lavasoft\WebCompanion\Frequently Asked Questions.url
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lavasoft\WebCompanion\Web Companion.lnk

Hooking and other Techniques for Hiding and Protection

Stores large binary data to the registry

Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 Blob

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -600000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86099968s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2480	Thread sleep time: -90000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -210016s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2480	Thread sleep time: -210000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86070094s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2480	Thread sleep time: -2880000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -89984s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -85830000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -450219s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -85949781s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -172800000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86370000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -777600000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86399875s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86399891s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -85800094s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -510015s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -85860047s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -540016s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -85380078s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -1019890s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2032	Thread sleep time: -300000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -85290219s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3572	Thread sleep time: -3840000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -1109781s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -84780407s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 6632	Thread sleep time: -90000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -1619593s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -84690500s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -1199719s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -85200266s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -1199844s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -85200125s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -1199875s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -85200109s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -1199859s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep count: 34 > 30
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -2937600000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -345600000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86310000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -89984s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86310016s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -60094s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86339890s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86399938s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -259199859s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86399922s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -85920032s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -479953s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -85920031s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -390078s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86009922s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -360187s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86039782s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -720468s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -172079532s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -360203s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86039765s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86340141s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -59812s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86340172s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -59828s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86250250s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -149750s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86250219s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -239782s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86280109s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86280094s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -238592s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86280688s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -238624s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -238594s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -345122812s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -834967s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -1035368628s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -954128s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -603965138s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -715500s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -954120s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -172561470s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -517684500s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -119235s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -258842295s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86280718s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -119282s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86280687s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86280704s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -119234s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -238438s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -258842343s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -238406s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86280797s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -119156s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86280844s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86280828s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -238250s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86280875s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -119063s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86280937s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -119047s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86280953s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -237970s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86281015s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -237814s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86281093s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -237656s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86281172s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86281157s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -118781s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -172562438s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -356016s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -172562656s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -237312s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -172562624s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -237158s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86281421s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -118688s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86281296s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -118704s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -172562374s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -237626s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86281203s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -118797s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -172562156s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -118906s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -118922s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86280938s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -238124s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86280766s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -119234s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86280797s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -119203s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86280766s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -119234s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -172561250s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -119375s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -238438s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -238094s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86280953s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -258842343s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86280594s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -119406s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -715500s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86280922s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -119078s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86280907s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -517686564s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -356670s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -172562220s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3936	Thread sleep count: 336 > 30
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3936	Thread sleep time: -168000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -118703s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86281297s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -118687s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -237782s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86280906s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -119094s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -594375s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -172562250s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -356016s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -172562656s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -236874s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86281563s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86281344s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -118454s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86281546s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86281515s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -236500s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86281750s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86281500s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -118500s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -172562470s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -237530s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -237030s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -258844455s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -118781s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -118516s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86281484s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86281234s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -118766s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86281468s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -118282s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -172563406s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -118297s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -118031s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86281969s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86281687s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -118313s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -172562812s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -355734s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86281407s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -118312s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86281688s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86281391s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -237218s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -258844266s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86281109s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -118594s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -237126s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86281437s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -118547s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86281141s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -118859s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -172562906s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -237124s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86281438s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -236468s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -172563532s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -236436s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86281782s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86281079s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -258843234s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -237844s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -1035368628s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -118937s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86281063s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86281062s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -118938s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -475624s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -118531s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86281469s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -345122812s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -118187s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -172563594s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -235594s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86282203s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -117812s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86282188s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -118203s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -172562062s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -118969s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -118156s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86281844s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -117766s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86282234s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -117359s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86282641s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -116953s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86283016s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -116578s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86283422s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -116172s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86283421s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -116579s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86283015s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -233938s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -172566062s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -116563s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86282625s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -117375s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86282218s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -117782s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86281812s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -118188s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86281390s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -118610s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86280968s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -119016s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86280578s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -119000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -172562000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -118141s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -117750s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86282250s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -117328s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86281828s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -235468s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86282266s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -117312s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -117735s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86281375s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -237250s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86280937s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86280938s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86280531s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -119031s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -238938s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86280094s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86280062s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -119500s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86280500s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86280516s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -238968s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -172560156s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -119922s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86279625s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -120375s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86279156s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86279610s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -239874s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86280063s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -119468s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86280047s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -119953s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86279594s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -172559218s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -239876s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -238970s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86280515s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -119032s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86279593s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -119907s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86280093s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86280547s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -118984s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -237970s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86280546s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -118062s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -118063s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -118046s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -118047s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 6780	Thread sleep time: -90000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86279593s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -120438s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86189125s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -210844s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86189156s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -210375s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86189094s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 4084	Thread sleep time: -5280000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -210843s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -85708704s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -422812s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86188109s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86188594s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -210938s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86188578s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -421906s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86188531s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 6780	Thread sleep time: -480000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86188547s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -211422s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86068250s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -331281s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86068188s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -331812s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86067172s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -241485s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86157046s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -242454s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -172314124s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -241969s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -241953s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep count: 129 > 30
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -11145600000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -691200000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86399454s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86399969s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86398484s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3936	Thread sleep count: 2160 > 30
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3936	Thread sleep time: -1080000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86399484s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86399953s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86399422s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86280188s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -259200000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3936	Thread sleep count: 767 > 30
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3936	Thread sleep time: -383500s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 6360	Thread sleep time: -4800000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -1296000000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86399484s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2236	Thread sleep time: -90000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 5256	Thread sleep time: -240000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86399968s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86399469s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86399422s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86338593s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -61344s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86323125s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -76859s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86322094s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -77906s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86321594s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -47391s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86274312s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -125188s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86274797s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -124672s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -85759437s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -640063s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -85695406s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -704047s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -85695937s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -223641s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -172352656s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -223672s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -223172s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86176828s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -222672s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86177328s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -221672s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86177328s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -146672s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86252828s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -147172s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -172504624s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -147688s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3936	Thread sleep count: 6652 > 30
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 3936	Thread sleep time: -3326000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -112188s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86268797s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -130687s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86268766s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -131219s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86267750s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -130750s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86268750s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -129734s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -85789875s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -609609s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -85787891s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -610109s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -85761891s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -637594s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -85752922s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -566578s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -85832906s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -566594s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -171620780s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -589610s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -588578s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -85790922s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -608578s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -85789407s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -602093s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -85797907s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -600093s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -85734407s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -665093s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -85734391s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -665625s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -257201577s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -1998423s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -85733359s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -186750s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86213250s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -186688s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86212312s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -156188s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86235312s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -138688s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86260797s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -139203s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86260281s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -138719s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86261281s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86399985s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86399406s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86398921s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86399453s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86398969s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86320984s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -45016s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86353969s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -45500s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86353968s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -46016s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86399938s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86399969s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86399437s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86322406s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -77594s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86312422s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -42062s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86318938s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -34124s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86308438s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86364938s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -35062s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86364438s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -35578s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86363906s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -36078s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86363907s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -35562s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86364438s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -59092s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86369954s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86369922s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86347922s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2708	Thread sleep time: -86399953s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe TID: 5948	Thread sleep time: -105500s >= -30000s

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WpfAnimatedGif.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\de-DE\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\System.Data.SQLite.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ja-JP\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\es-ES\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\NCalc.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Settings.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\fr-CA\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Interop.WUApiLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.SqlLite.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\BCUEngineS.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\BCUSDK.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Search.exe	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\de-DE\WebCompanionInstaller.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\ICSharpCode.SharpZipLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ru-RU\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.CSharp.Utilities.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\bwneskvk.dll	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\en-US\WebCompanionInstaller.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\acs17.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Microsoft.mshtml.dll	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\ru-RU\WebCompanionInstaller.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.Service.Logger.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Extension.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\uld_vmts.dll	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\pt-BR\WebCompanionInstaller.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WcfService.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\en-US\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\pt-BR\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\fr-CA\WebCompanionInstaller.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\x64\SQLite.Interop.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\7za.exe	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\ja-JP\WebCompanionInstaller.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\it-IT\WebCompanionInstaller.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\zh-Hans\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\tr-TR\WebCompanionInstaller.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\it-IT\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\gu1rlzui.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\x86\SQLite.Interop.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Interop.SHDocVw.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Repositories.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\tr-TR\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\es-ES\WebCompanionInstaller.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\DotNetZip.dll	Jump to dropped file
Source: C:\Users\user\Desktop\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\zh-CHS\WebCompanionInstaller.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\LZ4.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Esent.Interop.dll	Jump to dropped file

Contains long sleeps (>= 3 min)

Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 300000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86099968
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 210016
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86070094
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 480000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85830000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 450219
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85949781
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86400000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86370000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86400000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399875
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399891
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85800094
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 510015
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85860047
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 540016
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85380078
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 1019890
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85290219
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 480000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 1109781
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 84780407
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 1619593
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 84690500
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 1199719
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85200266
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 1199844
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85200125
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 1199875
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85200109
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 1199859
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86400000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86400000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86310000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86310016
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86339890
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399938
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399953
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399922
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85920032
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 479953
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85920031
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 390078
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86009922
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 360187
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86039782
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 360234
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86039766
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 360203
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86039765
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86340141
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86340172
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86250250
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86250219
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280109
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280094
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280688
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280703
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280719
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280734
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280735
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280750
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280765
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280718
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280687
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280704
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280781
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280797
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280844
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280828
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280875
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280937
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280953
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281015
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281093
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281172
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281157
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281219
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281328
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281312
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281421
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281296
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281187
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281203
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281078
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280938
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280766
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280797
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280766
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280625
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280953
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280781
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280594
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280922
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280907
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281094
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281110
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281297
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280906
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281125
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281328
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281563
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281344
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281546
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281515
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281750
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281500
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281235
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281485
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281484
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281234
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281468
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281703
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281969
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281687
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281406
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281407
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281688
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281391
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281422
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281109
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281437
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281141
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281453
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281438
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281766
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281782
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281079
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281078
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280719
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281063
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281062
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281469
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280703
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281797
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86282203
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86282188
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281031
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281844
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86282234
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86282641
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86283016
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86283422
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86283421
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86283015
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86283031
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86282625
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86282218
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281812
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281390
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280968
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280578
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86282250
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281828
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86282266
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281375
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280937
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280938
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280531
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280094
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280062
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280500
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280516
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280078
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86279625
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86279156
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86279610
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280063
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280047
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86279594
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86279609
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280515
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86279593
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280093
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280547
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280546
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86279593
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86189125
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 210844
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86189156
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 210375
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86189094
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 480000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 210843
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85708704
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 211406
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86188109
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86188594
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 210938
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86188578
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 210953
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86188531
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86188547
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 211422
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86068250
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 331281
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86068188
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 331812
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86067172
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 241485
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86157046
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 242454
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86157062
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 241969
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 241953
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86400000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86400000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399454
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399969
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86398484
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399484
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399953
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399422
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280188
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86400000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 480000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86400000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399484
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399968
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399469
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399422
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86338593
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86323125
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86322094
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86321594
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86274312
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86274797
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85759437
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 640063
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85695406
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 704047
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85695937
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 223641
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86176328
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 223672
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 223172
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86176828
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 222672
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86177328
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 221672
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86177328
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86252828
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86252312
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86268797
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86268766
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86267750
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86268750
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85789875
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 609609
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85787891
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 610109
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85761891
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 637594
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85752922
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 566578
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85832906
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 566594
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85810390
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 589610
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 588578
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85790922
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 608578
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85789407
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 602093
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85797907
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 600093
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85734407
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 665093
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85734391
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 665625
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85733859
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 666141
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85733359
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 186750
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86213250
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 186688
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86212312
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86235312
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86260797
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86260281
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86261281
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399985
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399406
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86398921
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399453
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86398969
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86320984
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86353969
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86353968
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399938
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399969
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399437
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86322406
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86312422
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86318938
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86308438
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86364938
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86364438
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86363906
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86363907
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86364438
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86369954
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86369922
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86347922
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399953

Is looking for software installed on the system

Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Registry key enumerated: More than 144 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Registry key enumerated: More than 210 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Registry key enumerated: More than 257 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Registry key enumerated: More than 257 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Registry key enumerated: More than 257 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Window / User API: threadDelayed 2160
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Window / User API: threadDelayed 767
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Window / User API: threadDelayed 6652

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe

Process information queried: ProcessInformation

Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 300000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86099968
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 90000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 210016
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86070094
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 480000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 89984
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85830000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 450219
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85949781
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86400000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86370000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86400000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399875
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399891
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85800094
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 510015
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85860047
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 540016
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85380078
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 1019890
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85290219
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 480000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 1109781
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 84780407
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 90000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 1619593
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 84690500
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 1199719
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85200266
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 1199844
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85200125
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 1199875
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85200109
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 1199859
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86400000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86400000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86310000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 89984
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86310016
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 60094
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86339890
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399938
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399953
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399922
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85920032
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 479953
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85920031
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 390078
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86009922
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 360187
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86039782
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 360234
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86039766
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 360203
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86039765
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86340141
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 59812
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86340172
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 59828
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86250250
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 149750
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86250219
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 119891
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280109
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280094
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 119296
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280688
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 119312
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 119297
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280703
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 119281
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280719
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 119266
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280734
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 119250
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 119265
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280735
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280750
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 119235
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280765
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280718
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 119282
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280687
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280704
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 119234
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 119219
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280781
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 119203
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280797
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 119156
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280844
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280828
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 119125
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280875
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 119063
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280937
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 119047
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280953
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118985
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281015
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118907
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281093
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118828
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281172
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281157
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118781
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281219
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118672
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281328
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118656
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281312
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118579
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281421
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118688
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281296
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118704
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281187
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118813
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281203
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118797
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281078
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118906
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118922
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280938
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 119062
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280766
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 119234
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280797
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 119203
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280766
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 119234
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280625
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 119375
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 119219
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 119047
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280953
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280781
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280594
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 119406
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 119250
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280922
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 119078
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280907
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281094
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118890
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281110
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118703
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281297
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118687
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118891
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280906
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 119094
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118875
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281125
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118672
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281328
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118437
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281563
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281344
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118454
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281546
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281515
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118250
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281750
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281500
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118500
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281235
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118765
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118515
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281485
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118781
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118516
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281484
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281234
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118766
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281468
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118282
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281703
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118297
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118031
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281969
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281687
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118313
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281406
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118578
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281407
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118312
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281688
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281391
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118609
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281422
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281109
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118594
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118563
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281437
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118547
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281141
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118859
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281453
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118562
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281438
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118234
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281766
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118218
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281782
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281079
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281078
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118922
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280719
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118937
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281063
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281062
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118938
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118906
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118531
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281469
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280703
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118187
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281797
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 117797
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86282203
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 117812
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86282188
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118203
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281031
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118969
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118156
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281844
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 117766
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86282234
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 117359
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86282641
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 116953
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86283016
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 116578
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86283422
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 116172
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86283421
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 116579
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86283015
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 116969
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86283031
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 116563
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86282625
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 117375
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86282218
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 117782
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281812
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118188
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281390
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118610
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280968
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 119016
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280578
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 119000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118141
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 117750
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86282250
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 117328
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281828
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 117734
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86282266
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 117312
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 117735
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86281375
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118625
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280937
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280938
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280531
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 119031
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 119469
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280094
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280062
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 119500
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280500
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280516
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 119484
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280078
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 119922
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86279625
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 120375
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86279156
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86279610
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 119937
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280063
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 119468
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280047
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 119953
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86279594
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86279609
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 119938
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 119485
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280515
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 119032
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86279593
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 119907
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280093
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280547
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118984
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118985
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280546
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118062
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118063
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118046
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 118047
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 90000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86279593
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 120438
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86189125
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 210844
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86189156
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 210375
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86189094
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 480000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 210843
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85708704
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 211406
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86188109
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86188594
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 210938
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86188578
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 210953
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86188531
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86188547
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 211422
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86068250
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 331281
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86068188
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 331812
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86067172
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 241485
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86157046
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 242454
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86157062
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 241969
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 241953
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86400000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86400000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399454
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399969
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86398484
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399484
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399953
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399422
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86280188
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86400000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 480000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86400000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399484
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 90000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399968
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399469
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399422
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86338593
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 61344
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86323125
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 76859
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86322094
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 77906
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86321594
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 47391
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86274312
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 125188
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86274797
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 124672
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85759437
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 640063
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85695406
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 704047
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85695937
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 223641
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86176328
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 223672
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 223172
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86176828
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 222672
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86177328
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 221672
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86177328
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 146672
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86252828
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 147172
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86252312
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 147688
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 112188
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86268797
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 130687
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86268766
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 131219
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86267750
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 130750
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86268750
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 129734
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85789875
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 609609
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85787891
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 610109
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85761891
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 637594
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85752922
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 566578
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85832906
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 566594
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85810390
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 589610
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 588578
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85790922
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 608578
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85789407
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 602093
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85797907
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 600093
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85734407
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 665093
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85734391
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 665625
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85733859
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 666141
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 85733359
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 186750
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86213250
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 186688
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86212312
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 156188
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86235312
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 138688
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86260797
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 139203
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86260281
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 138719
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86261281
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399985
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399406
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86398921
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399453
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86398969
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86320984
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 45016
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86353969
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 45500
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86353968
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 46016
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399938
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399969
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399437
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86322406
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 77594
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86312422
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 42062
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86318938
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86308438
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86364938
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 35062
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86364438
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 35578
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86363906
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 36078
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86363907
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 35562
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86364438
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86369954
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86369922
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86347922
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 86399953

Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File opened: C:\Users\user\AppData\Roaming\Lavasoft\
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File opened: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File opened: C:\Users\user\AppData\
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File opened: C:\Users\user\AppData\Roaming\
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File opened: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File opened: C:\Users\user\

Anti Debugging

Enables debug privileges

Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh http add urlacl url=http://+:9007/ user=Everyone
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\bwneskvk.cmdline
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\gu1rlzui.cmdline
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\uld_vmts.cmdline
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESA00A.tmp" "c:\Users\user\AppData\Local\Temp\CSC9FF9.tmp"
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESA903.tmp" "c:\Users\user\AppData\Local\Temp\CSCA8F2.tmp"
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESB3F0.tmp" "c:\Users\user\AppData\Local\Temp\CSCB3DF.tmp"
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Process created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe "C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe" --install --geo=

Language, Device and Operating System Detection

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.ServiceModel\3.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.ServiceModel\3.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.ServiceModel.Web\3.5.0.0__31bf3856ad364e35\System.ServiceModel.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.ServiceModel.Web\3.5.0.0__31bf3856ad364e35\System.ServiceModel.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\SMDiagnostics\3.0.0.0__b77a5c561934e089\SMdiagnostics.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\SMDiagnostics\3.0.0.0__b77a5c561934e089\SMdiagnostics.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.Runtime.Serialization\3.0.0.0__b77a5c561934e089\System.Runtime.Serialization.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.Runtime.Serialization\3.0.0.0__b77a5c561934e089\System.Runtime.Serialization.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Queries volume information: unknown VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\en-US\WebCompanionInstaller.resources.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\en-US\WebCompanionInstaller.resources.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\ICSharpCode.SharpZipLib.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\ICSharpCode.SharpZipLib.dll VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Events.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Events.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\3.5.0.0__31bf3856ad364e35\System.ComponentModel.DataAnnotations.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\3.5.0.0__31bf3856ad364e35\System.ComponentModel.DataAnnotations.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.Runtime.Serialization\3.0.0.0__b77a5c561934e089\System.Runtime.Serialization.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.Runtime.Serialization\3.0.0.0__b77a5c561934e089\System.Runtime.Serialization.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.Xml.Linq\3.5.0.0__b77a5c561934e089\System.Xml.Linq.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.Xml.Linq\3.5.0.0__b77a5c561934e089\System.Xml.Linq.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Interop.LavasoftTcpServiceLib.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Interop.LavasoftTcpServiceLib.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.ServiceModel\3.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.ServiceModel\3.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Ionic.Zip.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Ionic.Zip.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Compression.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Compression.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\MozCompressor.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Interop.IWshRuntimeLibrary.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Interop.IWshRuntimeLibrary.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.ServiceModel.Web\3.5.0.0__31bf3856ad364e35\System.ServiceModel.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.ServiceModel.Web\3.5.0.0__31bf3856ad364e35\System.ServiceModel.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\SMDiagnostics\3.0.0.0__b77a5c561934e089\SMdiagnostics.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\SMDiagnostics\3.0.0.0__b77a5c561934e089\SMdiagnostics.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.IdentityModel\3.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\System.IdentityModel\3.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh http add urlacl url=http://+:9007/ user=Everyone

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct

Adds / modifies Windows certificates

Source: C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 Blob

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\search.json.mozlz4
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\sp4c0p22.default-release\prefs.js
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	2 Windows Management Instrumentation	1 Windows Service	1 Windows Service	11 Masquerading	1 OS Credential Dumping	1 Query Registry	Remote Services	1 Data from Local System	Exfiltration Over Other Network Medium	2 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	11 Process Injection	1 Modify Registry	LSASS Memory	12 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	2 Ingress Tool Transfer	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	111 Disable or Modify Tools	Security Account Manager	11 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Non-Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	2 DLL Search Order Hijacking	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Traffic Duplication	5 Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	Launchd	Network Logon Script	2 DLL Search Order Hijacking	11 Process Injection	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Scheduled Transfer	Fallback Channels			Data Encrypted for Impact	Server	Gather Victim Network Information
Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	3 File and Directory Discovery	VNC	GUI Input Capture	Data Transfer Size Limits	Multiband Communication			Service Stop	Botnet	Domain Properties
External Remote Services	Systemd Timers	Startup Items	Startup Items	2 DLL Search Order Hijacking	DCSync	32 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over C2 Channel	Commonly Used Port			Inhibit System Recovery	Web Services	DNS

Source	Detection	Scanner	Label	Link
setup.exe	24%	ReversingLabs	Win32.PUA.ICBundler
setup.exe	35%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\7zS855E9B1B\ICSharpCode.SharpZipLib.dll	4%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS855E9B1B\ICSharpCode.SharpZipLib.dll	1%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\7zS855E9B1B\Newtonsoft.Json.dll	4%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS855E9B1B\Newtonsoft.Json.dll	1%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	14%	ReversingLabs	Win32.PUA.Generic
C:\Users\user\AppData\Local\Temp\7zS855E9B1B\WebCompanionInstaller.exe	35%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\7zS855E9B1B\de-DE\WebCompanionInstaller.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS855E9B1B\de-DE\WebCompanionInstaller.resources.dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\7zS855E9B1B\en-US\WebCompanionInstaller.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS855E9B1B\en-US\WebCompanionInstaller.resources.dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\7zS855E9B1B\es-ES\WebCompanionInstaller.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS855E9B1B\es-ES\WebCompanionInstaller.resources.dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\7zS855E9B1B\fr-CA\WebCompanionInstaller.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS855E9B1B\fr-CA\WebCompanionInstaller.resources.dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\7zS855E9B1B\it-IT\WebCompanionInstaller.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS855E9B1B\it-IT\WebCompanionInstaller.resources.dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\7zS855E9B1B\ja-JP\WebCompanionInstaller.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS855E9B1B\ja-JP\WebCompanionInstaller.resources.dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\7zS855E9B1B\pt-BR\WebCompanionInstaller.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS855E9B1B\pt-BR\WebCompanionInstaller.resources.dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\7zS855E9B1B\ru-RU\WebCompanionInstaller.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS855E9B1B\ru-RU\WebCompanionInstaller.resources.dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\7zS855E9B1B\tr-TR\WebCompanionInstaller.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS855E9B1B\tr-TR\WebCompanionInstaller.resources.dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\7zS855E9B1B\zh-CHS\WebCompanionInstaller.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS855E9B1B\zh-CHS\WebCompanionInstaller.resources.dll	0%	Virustotal		Browse
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\7za.exe	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\7za.exe	1%	Virustotal		Browse
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\BCUEngineS.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\BCUEngineS.dll	1%	Virustotal		Browse
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\BCUSDK.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\BCUSDK.dll	1%	Virustotal		Browse
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\DotNetZip.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\DotNetZip.dll	1%	Virustotal		Browse
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Esent.Interop.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Esent.Interop.dll	1%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
wsgeoip.lulusoft.com	0%	Virustotal		Browse
3.246.11.0.in-addr.arpa	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://wsgeoip.lulusoft.com/IPService.asmx	0%	Avira URL Cloud	safe
http://wsgeoip.lulusoft.com/IPService.asmx	2%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
wsgeoip.upclick.com	64.18.92.11	true	false		high
wcdownloadercdn.lavasoft.com	104.17.9.52	true	false		high
featureflags.lavasoft.com	104.17.9.52	true	false		high
wsgeoip.lulusoft.com	104.26.14.158	true	false	0%, Virustotal, Browse	unknown
wc-partners.lavasoft.com	64.18.87.81	true	false		high
flow.lavasoft.com	104.17.9.52	true	false		high
wsgeoip.lavasoft.com	64.18.87.4	true	false		high
3.246.11.0.in-addr.arpa	unknown	unknown	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://flow.lavasoft.com/v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1	false		high
http://wc-partners.lavasoft.com/Partner.svc/GetPartnerInfo?partner=IN220101_wb	false		high
http://wcdownloadercdn.lavasoft.com/10.1.2.519/WebCompanion-10.1.2.519-prod.zip	false		high
http://flow.lavasoft.com/v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1	false		high
http://flow.lavasoft.com/v1/event-stat-wc?Type=FirstRun&ProductID=wc&EventVersion=1	false		high
http://wsgeoip.lulusoft.com/IPService.asmx	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://wc-partners.lavasoft.com/Partner.svc/GetPartnerInfo?partner=IN220101_ab	false		high
http://wc-partners.lavasoft.com/Partner.svc/GetPartnerInfo?partner=IN220101_ac	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
72.21.81.240	unknown	United States	15133	EDGECASTUS	false
64.18.87.4	wsgeoip.lavasoft.com	Canada	21548	MTOCA	false
104.17.9.52	wcdownloadercdn.lavasoft.com	United States	13335	CLOUDFLARENETUS	false
64.18.87.81	wc-partners.lavasoft.com	Canada	21548	MTOCA	false
104.26.14.158	wsgeoip.lulusoft.com	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox Version:	38.0.0 Ammolite
Analysis ID:	1343592
Start date and time:	2023-11-16 14:20:54 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample file name:	setup.exe
Detection:	MAL
Classification:	mal63.troj.spyw.expl.evad.winEXE@24/167@9/22
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): dllhost.exe
Excluded IPs from analysis (whitelisted): 72.21.81.240
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtReadFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	341
Entropy (8bit):	4.568219519473655
Encrypted:	false
SSDEEP:
MD5:	173C8E5D53012FCD93034042F8464A19
SHA1:	226FAFB255A07EE20E0522A8902638844AFB88F1
SHA-256:	5BA3803C178A75C84F9868BAE53EDB497F63869DE941DC21578546185C269D77
SHA-512:	D1CA7EFBB86066CC8E1D0DC91B122D3B7F98C56F49F449DA405D36304E73905986EB697604360EC4BF6B2FA6603AD3020624428D2A67DB050CD141E23780EEB5
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="TriggerType" serializeAs="String">.. <value>afterinstall</value>.. </setting>.. </WebCompanion.UI.Properties.Settings>.. </userSettings>..</configuration>

Process:	C:\Users\user\Desktop\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	212296
Entropy (8bit):	5.740854639698686
Encrypted:	false
SSDEEP:
MD5:	1E16BAD4F6A563C46161BB4FB0CFEC4F
SHA1:	E86EE8B835814FF6E6D6709A00694D0308CC83F3
SHA-256:	C7B5080EA8B2753751CB6252A3E9EDD2A292D8A141DE9E65CD3D0005EBE041E9
SHA-512:	A0A52C24BDE70DFD22D0C7B57A2AE53927A5EFD2A6DD18A325F7D03A6FD94EEB6C5885B63C7E135BAC786BC4BDE82640584E76AB04D9A9E6BF24923B9F05E7E3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4% Antivirus: Virustotal, Detection: 1%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...........!......... ........... ........@.. .......................@......./....@.................................d...W.......................H-... ....................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	676
Entropy (8bit):	3.267240884156178
Encrypted:	false
SSDEEP:
MD5:	B7F71FB48B26131D79C354113EC34CA8
SHA1:	8880FEB80597E7FDEA5AD5492469E63EDABC443B
SHA-256:	C3F5AF0F7E9EFC3CBB2A503087B4241082EA93E0AE7E24C951D7666F1EBB5F8A
SHA-512:	8E18D85357CF30174471128B949E8A92AD8537F534BA687C523E8152A5C868EF990F63F7F6C7E9A92FCA0FF89FC922E2DF6824795C7240C5DC60B9C526D96AC2
Malicious:	false
Reputation:	low
Preview:	.... ...........................d...<...............0...........d.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...8.....F.i.l.e.V.e.r.s.i.o.n.....1.0...1...2...5.1.9.....<.....I.n.t.e.r.n.a.l.N.a.m.e...b.w.n.e.s.k.v.k...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...b.w.n.e.s.k.v.k...d.l.l.....<.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...1.0...1...2...5.1.9.....@.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...1.0...1...2...5.1.9.....

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.196439344671015
Encrypted:	false
SSDEEP:
MD5:	2D66423AB0CF1EB6EE1934C24641F0B3
SHA1:	73CE8641508CF515377BCDDBC8CFBC80B2C9420D
SHA-256:	B50C0DC00937BBDFBDD727F661A97B07A1B388C3AC02FA23249B9ED10248BC3D
SHA-512:	99022D52F317E8B66665488DE2B609CADE51AB97411F79920CC7AD70B6857B306172281D0E41CD7FBF8FEDEBE095F575001CCCE564ED27554E9279D2C572A2BA
Malicious:	false
Reputation:	low
Preview:	..URL reservation successfully added....

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.673267624793489
TrID:	Win32 Executable (generic) a (10002005/4) 99.40% InstallShield setup (43055/19) 0.43% Windows Screen Saver (13104/52) 0.13% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	setup.exe
File size:	566'584 bytes
MD5:	9dcbe10dc787bde1e69fca29878e6083
SHA1:	6693bc9d31cd96c37bc81c9d49fec7f0948a56fe
SHA256:	928dba830954eca52d25b94bc36c2e5d24b332a2cbfa8cd38802258caaa9d2c4
SHA512:	e615e997457e2ad6783ccf648fd15edbbfd26cd7eb5ca333ee492f9360d94287e5ff700252903b9f20a67c0791779912f0e54c7a818a251416a693d3a3ea0ac7
SSDEEP:	12288:oG5knZfFKeX5bTUoaws89d99m7pSRGzDP5SAkG:oG50ZfFKgFL9m7e2jUW
TLSH:	3EC401113EE5C8B6D5810031C9656FA1E2FAFE560E11486333997E3E3F7E992C231A5A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s..c}...s..Yy...s..w,...s...r./.s..w....s..Yx...s.......s.......s.Zyu...s.Rich..s.................PE..L......M...

Entrypoint:	0x4148d4
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x4DAC88CE [Mon Apr 18 18:54:06 2011 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	e00de6e48b9b06aceb12a81e7bf494c9

Signature Valid:	true
Signature Issuer:	CN=Entrust Extended Validation Code Signing CA - EVCS2, O="Entrust, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	20/02/2023 19:09:57 20/02/2024 19:09:57
Subject Chain	CN=Lavasoft Software Canada Inc., SERIALNUMBER=709505-8, OID.2.5.4.15=Private Organization, O=Lavasoft Software Canada Inc., OID.1.3.6.1.4.1.311.60.2.1.3=CA, L=Saint-Laurent, S=Quebec, C=CA
Version:	3
Thumbprint MD5:	79557A8E79BEDC7988A12974BD520169
Thumbprint SHA-1:	E62CA9DC614F7B8E3DC4C7E7E8D0D87A79DD13FA
Thumbprint SHA-256:	C9ED3A5ABAFC7367A3FD190A6BE1FB95D9E7C2D3FB4FD2681E45D6ACD5F1142F
Serial:	74EF4A34E9A06529277ECE07392AF2E5

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1e9ac	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x27000	0x71cc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x87260	0x32d8
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1b000	0x200	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x197c0	0x19800	False	0.5831609987745098	DOS executable (COM)	6.60822715389085	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1b000	0x4490	0x4600	False	0.312109375	data	4.383775518811042	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x20000	0x5a68	0x3200	False	0.123828125	data	1.3793356235333818	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.sxdata	0x26000	0x4	0x200	False	0.02734375	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_LNK_INFO, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x27000	0x71cc	0x7200	False	0.3920641447368421	data	4.657579755868766	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x27354	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.37231182795698925
RT_ICON	0x2763c	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.5472972972972973
RT_ICON	0x27764	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2833 x 2833 px/m			0.3200354609929078
RT_ICON	0x27bcc	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304, resolution 2833 x 2833 px/m			0.23688524590163934
RT_ICON	0x28554	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2833 x 2833 px/m			0.1721388367729831
RT_ICON	0x295fc	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2833 x 2833 px/m			0.1241701244813278
RT_ICON	0x2bba4	0x1a7b	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			0.9648915769287506
RT_DIALOG	0x2d620	0xb8	data	English	United States	0.6684782608695652
RT_STRING	0x2d6d8	0x94	data	English	United States	0.668918918918919
RT_STRING	0x2d76c	0x34	data	English	United States	0.6538461538461539
RT_GROUP_ICON	0x2d7a0	0x4c	data			0.8289473684210527
RT_GROUP_ICON	0x2d7ec	0x22	data	English	United States	1.0
RT_VERSION	0x2d810	0x33c	data	English	United States	0.4396135265700483
RT_MANIFEST	0x2db4c	0x67f	exported SGML document, ASCII text, with CRLF line terminators	English	United States	0.3692122669873722

DLL	Import
OLEAUT32.dll	VariantClear, SysAllocString
USER32.dll	SendMessageA, SetTimer, DialogBoxParamW, DialogBoxParamA, SetWindowLongA, GetWindowLongA, SetWindowTextW, LoadIconA, LoadStringW, LoadStringA, CharUpperW, CharUpperA, DestroyWindow, EndDialog, PostMessageA, ShowWindow, MessageBoxW, GetDlgItem, KillTimer, SetWindowTextA
SHELL32.dll	ShellExecuteExA
KERNEL32.dll	GetCurrentDirectoryA, GetStringTypeW, GetStringTypeA, LCMapStringW, LCMapStringA, InterlockedIncrement, InterlockedDecrement, GetProcAddress, GetOEMCP, GetACP, GetCPInfo, IsBadCodePtr, IsBadReadPtr, GetFileType, SetHandleCount, GetEnvironmentStringsW, GetEnvironmentStrings, FreeEnvironmentStringsW, FreeEnvironmentStringsA, UnhandledExceptionFilter, HeapSize, GetCurrentProcess, TerminateProcess, IsBadWritePtr, HeapCreate, HeapDestroy, GetEnvironmentVariableA, SetUnhandledExceptionFilter, TlsAlloc, ExitProcess, GetVersion, GetCommandLineA, GetStartupInfoA, GetModuleHandleA, WaitForSingleObject, CloseHandle, CreateProcessA, GetCommandLineW, GetVersionExA, LeaveCriticalSection, EnterCriticalSection, DeleteCriticalSection, MultiByteToWideChar, WideCharToMultiByte, GetLastError, LoadLibraryA, GetModuleFileNameW, GetModuleFileNameA, LocalFree, FormatMessageW, FormatMessageA, SetFileTime, CreateFileW, SetLastError, SetFileAttributesW, SetFileAttributesA, RemoveDirectoryW, RemoveDirectoryA, CreateDirectoryW, CreateDirectoryA, DeleteFileW, DeleteFileA, GetFullPathNameW, GetFullPathNameA, SetCurrentDirectoryW, SetCurrentDirectoryA, GetCurrentDirectoryW, GetTempPathW, GetTempPathA, GetCurrentProcessId, GetTickCount, GetCurrentThreadId, FindClose, FindFirstFileW, FindFirstFileA, FindNextFileW, FindNextFileA, CreateFileA, GetFileSize, SetFilePointer, ReadFile, WriteFile, SetEndOfFile, GetStdHandle, WaitForMultipleObjects, Sleep, VirtualAlloc, VirtualFree, CreateEventA, SetEvent, ResetEvent, InitializeCriticalSection, RtlUnwind, RaiseException, HeapAlloc, HeapFree, HeapReAlloc, CreateThread, TlsSetValue, TlsGetValue, ExitThread

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report setup.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Yara Signatures

Dropped Files

Sigma Signatures

Data Obfuscation

Snort Signatures

Joe Sandbox Signatures

AV Detection

Privilege Escalation

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

General Information

Warnings

Created / dropped Files

(copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Lavasoft\Web Companion\Logs\Webcompanion\webcompanion.log

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_kbdxbdyeiodfntntotimgep5mmfewgmy\10.1.2.519\2nptwtq8.newcfg

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_kbdxbdyeiodfntntotimgep5mmfewgmy\10.1.2.519\2qyxaaap.newcfg

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_kbdxbdyeiodfntntotimgep5mmfewgmy\10.1.2.519\43s5ht1v.newcfg

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_kbdxbdyeiodfntntotimgep5mmfewgmy\10.1.2.519\7mwairfv.newcfg

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_kbdxbdyeiodfntntotimgep5mmfewgmy\10.1.2.519\7nzvs1a0.newcfg

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_kbdxbdyeiodfntntotimgep5mmfewgmy\10.1.2.519\8ievdmuu.newcfg

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_kbdxbdyeiodfntntotimgep5mmfewgmy\10.1.2.519\9phv_uky.newcfg

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_kbdxbdyeiodfntntotimgep5mmfewgmy\10.1.2.519\aozjqrcj.newcfg

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_kbdxbdyeiodfntntotimgep5mmfewgmy\10.1.2.519\co_mx4t1.newcfg

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_kbdxbdyeiodfntntotimgep5mmfewgmy\10.1.2.519\dqyxq66s.newcfg

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_kbdxbdyeiodfntntotimgep5mmfewgmy\10.1.2.519\dxst2h0c.newcfg

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_kbdxbdyeiodfntntotimgep5mmfewgmy\10.1.2.519\fxx_rnbc.newcfg

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_kbdxbdyeiodfntntotimgep5mmfewgmy\10.1.2.519\gkst4tla.newcfg

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_kbdxbdyeiodfntntotimgep5mmfewgmy\10.1.2.519\hv-jasr0.newcfg

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_kbdxbdyeiodfntntotimgep5mmfewgmy\10.1.2.519\iucashcy.newcfg

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_kbdxbdyeiodfntntotimgep5mmfewgmy\10.1.2.519\j606blpf.newcfg

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_kbdxbdyeiodfntntotimgep5mmfewgmy\10.1.2.519\k8emhh49.newcfg

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_kbdxbdyeiodfntntotimgep5mmfewgmy\10.1.2.519\l0racqmd.newcfg

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_kbdxbdyeiodfntntotimgep5mmfewgmy\10.1.2.519\mbuf-2uy.newcfg

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_kbdxbdyeiodfntntotimgep5mmfewgmy\10.1.2.519\mtpe5cus.newcfg

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_kbdxbdyeiodfntntotimgep5mmfewgmy\10.1.2.519\n3mmpimc.newcfg

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_kbdxbdyeiodfntntotimgep5mmfewgmy\10.1.2.519\naxubq7e.newcfg

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_kbdxbdyeiodfntntotimgep5mmfewgmy\10.1.2.519\nb3jm_tf.newcfg

Windows Analysis Report
setup.exe

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre